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ABSTRACT 


Since 9/11 there have been many demands for robust intelligence efforts 
and information sharing in the context of Homeland Security. This thesis focuses 
on the critical need for the inclusion of local and state intelligence collection 
efforts into the broader intelligence community and describes a model for states 
to follow when creating a statewide Information Sharing and Analysis Center. 
Key organizational and relationship principles are examined. Establishing state 
ISACs and including them as partners in fight against terrorism benefits all levels 
of government at the strategic and tactical intelligence levels. Requirements for 
successful state level ISACs are identified through numerous cases studies 
focusing on the Georgia Information Sharing and Analysis Center. 
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I. INTRODUCTION 


The events that occurred on September 11, 2001 changed many things 
about life in America. While terrorists, both domestic and international, had 
committed acts of terrorism in the United States prior to 9/11; on that day 
everyone knew that these attacks signified something different. That day there 
were no doubts to the resolve, creativity and capability of the enemy. Many 
questioned, at the time, the identity of the enemy but no one questioned the fact 
that an enemy existed and they were attacking us in our own backyard. 

One particular change about life in America since 9/11 is the subject of 
this thesis, the need for government officials at all levels to have accurate, timely, 
and exhaustive intelligence information. The intelligence community is the 
system that collects, develops and analyzes information that can be used to 
identify and defeat our terrorist enemies. That system must now be repaired. 
The very system that is not only responsible for developing, collecting, analyzing 
but also for sharing intelligence information, failed on 9/11. One of the reasons 
for that failure was the virtual exclusion of input from state and local law 
enforcement into that system. On that tragic day foreign-initiated acts of 
terrorism occurred in America. Not against American interests in Yemen, Kabul 
or Beirut but in cities and states in the homeland of the United States of America. 
The attacks were not state sponsored military offensive maneuvers utilizing 
military forces and weaponry, but were instead offensive maneuvers by terrorists 
who were living here, planning here and operating under the radar screen of the 
established intelligence community. The intelligence community had previously 
failed with both international and domestic attacks, but since 9/11 solutions are 
being demanded. This thesis offers a solution. 

A. PURPOSE 

The purpose of this thesis is not to try and solve each and every issue or 
problem that exists within the intelligence community. The purpose of this thesis 
is to prove is that state and local governments have a key role to play in the 

system we refer to as the intelligence community. Further, this thesis will show 
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that not only do state and local governments need information from the 
intelligence community but the intelligence community desperately needs 
information from state and local governments. Additionally, this thesis will 
describe the requirements that are necessary for a successful state level 
Information Sharing and Analysis Center (ISAC) effort. The final point of the 
thesis is to show the important organizational features of a state ISAC. To 
describe how the Georgia ISAC (GISAC) was created the successes it has had 
and through case studies highlight important points, successes and challenges 
faced by states in their effort to develop ISACs. All in order to give other states a 
solution and a model to consider when developing state level intelligence 
capabilities. Today each state needs this capability and the federal intelligence 
community needs the input of the fifty states. The author’s argument is that the 
current intelligence system has failed and it is necessary for states to develop 
information collection, sharing and analysis capabilities to do their part in the fight 
against terrorism. States have a significant role in terrorism prevention in the 
homeland security context. As Secretary Tom Ridge has stated, “If we secure 
the hometowns, we will secure the homeland.’"' 

B. IMPORTANCE 

We now know that not only are domestic terrorists living in our 
communities but international terrorists as well and it is from our own 
neighborhoods in which they are staging their attacks. Of course, we know the 
nineteen Al Qaeda hijackers from 9/11 were living in the United States, but do 
not think that those nineteen were an anomaly or represent some temporary hole 
in the immigration system. Nor should you think that Al Qaeda is the only 
international terrorist organization represented in our homeland. Consider the 
case recently prosecuted in North Carolina where nineteen people, all operatives 
of Hezbollah, were convicted of money laundering and smuggling money back to 
the Middle East for support of terrorism. Additionally consider the statement of 
U.S. Attorney Robert Conrad, "I believe that if there is a Hezbollah terrorist cell in 

Don Plummer and Rebecca Carr. “U.S. Still Donning Security Armor”. The Atlanta Journal- 
Constitution. 12 May 2002. 
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Charlotte, then there are similar cells elsewhere."2 There is ample, actually 
plentiful, evidence that there are various terrorists (both international and 
domestic) and those who provide material support to terrorist organizations living 
in the United States. If the people who seek to destroy us are living among us 
then we cannot rely solely on some foreign legal attache or upon some signals 
intelligence source aimed at a safe-house in a country, of which most of us can 
not properly pronounce the name, to provide all of our intelligence information. 
We must consider the abundance and critical nature of the information that is 
available at the state and local government level. By the way, the information that 
initiated the investigation into the Hezbollah cell in North Carolina was provided 
by an alert local Sheriff’s deputy. He was off duty one day and noticed a young 
Middle Eastern man buying large quantities of cigarettes with cash and reported 
the information to the authorities. 

C. A SOLUTION 

Not only do state and local governments need to be allowed ingress and 
egress into the intelligence community. There must be a mechanism to allow for 
that access. The State of Georgia has created such a mechanism that has 
proven to be both effective and efficient in accomplishing that mission. In 
October of 2001 the Georgia Information Sharing and Analysis Center (GISAC) 
was created as that state’s first effort at preventive efforts toward terrorism. 
There were several goals for GISAC initially; establish a central organization 
where local governments could deposit pieces of information they thought to be 
suspicious relating to potential terrorism; create a liaison with the federal 
government’s intelligence community through the FBI and to facilitate the sharing 
of any pertinent information with local and/or federal agencies as needed. 

For many years local, state and even federal law enforcement intelligence 
efforts have been focused on traditional criminal intelligence activities including 
organized crime and drug trafficking; international terrorism was something to be 
handled by the military or the Central Intelligence Agency. For some reason 


2 Toni Locy. “U.S. Looks at Potential Danger From Hezbollah”. USA Today. 14 May 2003. 
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it appeared to be the conventional wisdom that in America, until 
recently, terrorism was infrequent and unimportant. In fact, in the 
past half-century, the United States has experienced a significant 
amount of terrorism.3 

Today we are again reminded that terrorists, both international and 
domestic, are living on American soil and history tells us that America is 
vulnerable to those terrorists.^ Now, with the spotlight of 9/11 on the failure of 
the intelligence community, we must enlist and include the valuable contributions 
that state/local governments can provide to the intelligence system. 

The GISAC is nearly three years old and has enjoyed tremendous 
success. The organization has been recognized by the National Governor’s 
Association as part of a state contingent invited to participate in a Policy 
Academy for Best Practices in Homeland Security in 2002. GISAC has also 
been involved in many successful and high profile cases and investigations that 
have contributed to the overall intelligence effort in our country. In addition, the 
organization is currently breaking new ground by participating as a co lead 
agency (with the FBI) in the intelligence operations for the upcoming Group of 
Eight Summit (G8) to be held on Sea Island, Georgia in June 2004. 

D. CHAPTER BY CHAPTER SUMMARY 

One particular high profile case occurred in September 2002 and is 
referred to as the Alligator Alley case. That case, summarized in Chapter II, 
demonstrates several points that will be expanded upon throughout this paper; 
the importance of local inputs, the necessity of relationships and connectivity with 
other states and the federal government and the viable role of local governments 
to deny terrorist plots. That chapter will further describe the requirements of an 
effective information sharing system that is a necessary addition to every state 
and to the intelligence community. 


3 Christopher Hewitt. Understanding Terrorism In America: From the Klan to Al Qaeda. 
London, Routledge, 2003. p. 12. 

^ Ibid. Hewitt asserts between 1954 and 9/11 “well over 3000 terrorists incidents...have taken 
place within the United States and Puerto Rico...and it would be a serious misreading of the 
historical record to see terrorism as either a new or a trivial phenomenon in America.” 
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There are other requirements beyond the need to develop a system that is 
able to capture, analyze and pass along the information from the hundreds of 
thousands of local law enforcement and government officials working in 
communities every day. It is also important to have a local mechanism to 
disseminate the strategic intelligence information that is typically developed by 
the federal government. The State of Georgia does not, and it is doubtful that it 
ever will, develop operatives in Afghanistan or dispatch interrogators to 
Guantanamo Bay to gain the type of information that will give an idea of the 
strategic nature of the enemy. The federal government does, however, and the 
states must have a mechanism for receiving that information and providing it to 
state level policy makers. These policy makers need to have strategic 
intelligence information to make sound resource allocation decisions for their part 
in the homeland security mission. 

Further, states need to be able to collect and disseminate information at 
the tactical intelligence level. If the collection and analysis system is working 
properly states can provide valuable pieces of information to the federal 
government who is in the position to “connect the dots” from a regional or 
national perspective. Depending on the type of information, states often can take 
action independently when an impending attack is discovered or if plans are 
discovered that do not have regional or national implications. Several cases 
studies in Chapter III highlight examples of the state taking action on information 
that had a state rather than a national impact. 

Chapter III begins with a historical documentation of GISAC and how the 
unit was established, why it is successful, the challenges that unit is facing and 
how they are being addressed to ensure its future success. Several case studies 
of actual events are used to accentuate important principles and show that 
GISAC is an effective model for states to consider when designing mechanisms 
for access into the intelligence community. 
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Equally important this chapter discusses key relationships of GISAC both 
internal and external to the unit. In the intelligence community, organizational 
and personal relationships are very important and impact the flow of information. 

All “wiring” diagrams, no matter how sophisticated, are deceptive. 

They portray where agencies sit in relation to one another, but they 
cannot portray how they interact and which relationships matter and 
why. Moreover, although we are loath to admit it, personalities do 
matter. However much we like to think of government as one of 
laws and institutions, the personalities and relationships of the 
people filling these important positions also effect agency working 
relations.5 

One of the most important relationships for GISAC is the one established 
with the FBI and the Joint Terrorism Task Force (JTTF) operated out of their 
Atlanta office. That relationship was formed and eventually GISAC moved into 
the same building and only one floor separates the two entities. As the unit 
matured various capabilities and products to support state policy makers were 
developed and enhanced. Some of these capabilities have their roots in the 
criminal intelligence realm while some have been developed specifically since 
9/11 to fight the war on terror at home. 

Chapter III concludes by examining challenges GISAC is facing in light of 
its success during the past two and one half years. Certain sectors of critical 
infrastructure are beginning to develop Information Sharing and Analysis Centers 
of their own. The challenge is to encourage their development for the sharing 
and analytical capability but to maintain its centrality of all intelligence activities 
for Georgia. Success has also created high expectations for the unit to maintain. 
In June 2004, the Group of Eight Summit will be held at Sea Island, Georgia and 
GISAC will play a key role in this National Security Special Event. GISAC and 
the other federal partners will staff a fusion center and GISAC will also be taking 
the lead role in staffing and commanding the field intelligence units. 


^ Mark Lowenthal. Intelligence: From Secrets to Policy, 2''^ ed., CQ Press, Washington, 
D.C., 2003. p. 30. 
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Chapter IV is the concluding chapter and will provide a concise summary 
of the lessons learned and the evidence supporting the position offered in this 
thesis. First, the intelligence community has experienced failures in both 
international and domestic terrorism attacks conducted in America. On 9/11 
failures in the intelligence community were amplified. Second, a key solution to 
repairing the intelligence community is to include state and local intelligence 
efforts into the broader intelligence community effort. This inclusion into the 
broader effort benefits both federal and state/local preparedness and prevention 
efforts. Third, requirements of successful state level information, sharing and 
analysis capabilities are examined. These requirements are discussed in the 
context of strategic and tactical level dimensions. Beyond those dimensions, the 
Alligator Alley case study reveals several fundamental principles that all state 
level ISACs must incorporate to achieve success. Finally, the state of Georgia 
has developed an organization that achieves these principles and provides for 
the intelligence needs of both state and federal levels of governments. GISAC is 
a model useful for other states to utilize as they develop this capability. 

Indeed, the awful events of 9/11 changed many things about life in 
America. One of the things that changed in Georgia was the way state leaders 
decided to address their role in the intelligence community and their role in 
preventing terrorism on a local level. No one knew at the time whether GISAC 
would succeed or fail or what exactly their mission would be. After deciding that 
something must be done, the state requirements for successful information 
sharing and intelligence had to be developed. 
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II. REQUIREMENTS FOR EFFECTIVE INFORMATION 
SHARING AND INTELLIGENCE ON THE STATE GOVERNMENT 

LEVEL 


It is easy, and today quite fashionable, to condemn the entire intelligence 
community for the failure to identify the plans and subsequently thwart the 
terrorist attacks perpetrated by members of Al Qaeda on 9/11. Enough time has 
passed at this point for all of us to have completed our cycle of emotions (denial, 
rage, attribution and revenge) and get to the business of solving the problems 
made manifest by the attacks. It has been widely reported in the media and 
thoroughly examined by congressional inquiry that while the exact timing, 
location and method of the attacks were a surprise, the intention that Al Qaeda 
wanted to further harm United States interests was not a surprise at all to certain 
members of the intelligence community. The assertion that bits and pieces of 
information, now known to be significant regarding the attacks, could have been 
assembled to uncover the plot to kill thousands of Americans may never be fully 
conclusive. 

While the attacks on 9/11 have certainly brought to the forefront the 
problems within the intelligence community, the United States is no stranger to 
successful acts of terrorism. The same terrorist organization of 9/11, Al Qaeda, 
was responsible for the first attack on the World Trade Center in 1993. More 
numerous, however, are domestic terrorists who have been successful in 
conducting many violent and disruptive acts. Timothy McVeigh, committed one 
of the most deadly terrorists attacks ever in the United States by bombing the 
Alfred P. Murrah Federal Building in Qklahoma City killing 168. Eric Robert 
Rudolf, one of the most elusive domestic terrorists, bombed abortion clinics and 
disrupted the Centennial Qlympic Games by detonating a bomb in Centennial 
Qlympic Park killing two and injuring 103 people. These are but a few examples 
of the numerous acts of terrorism that have been committed in the homeland. 
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While blame and vindication may be important to some, the important 
work, I believe, is to examine what went wrong and repair those problems. 
These constructive actions will be what minimize the chances of a similar 
“failures” from occurring again. 

The task of reengineering the intelligence community is huge and must be 
tackled by think tanks and task forces vast enough to meet the challenge. There 
were “intelligence failures” and ultimately the attacks on 9/11 were not prevented. 
The intelligence community and the system by which intelligence and information 
is collected, analyzed and shared must be reengineered to incorporate the 
lessons we have learned. One of those lessons is that state and local 
governments have a very important role to play and have very high stakes in the 
success of that system. What this thesis will do is examine but one very narrow 
component of that reengineering necessity, the role of state and local 
governments in the intelligence community and the way the State of Georgia has 
positioned itself to make a contribution to that effort. More specifically, however, 
this chapter is devoted to outlining the important requirements necessary for 
effective information sharing and intelligence dissemination to occur at the state 
and local levels. 

The Markle Foundation Task Force Report addressed the organizational 
challenges necessary to restructure the intelligence community for the effective 
collection and use of local information. 

The first step should be to focus on how information from state and 
localities, which is so crucial to the homeland security effort, can 
reach those in the federal government who need to act on it, and 
how the federal government’s information can reach those on the 
front line. To be effective at collecting and using all relevant 
information, the entire national system must work like a network, 
coordinated at the federal level but controlled locally. Two concrete 
steps can help start this process. First, states must begin 
organizing themselves to gather and share information more 
effectively. Second, the federal government needs one entity 
responsible for coordinating its role in this effort.® 

® Protecting America’s Freedom in the Information Age: A Report of the Markle Foundation 
Task Force. October 2002. New York. p. 75. 


10 



Regarding antiterrorism intelligence requirements, state and local 
governments’ demands do not differ significantly from those of the federal 
agencies combating terrorism inside of the United States. Each covets strategic 
and tactical intelligence, in addition the states need a single point of contact with 
(or ingress into) the federal system and must have the capability to provide 
intelligence to their policy makers. Here will be discussed the needs and 
interrelationships necessary for each level of government to meet the 
requirements for counterterrorism in the homeland, to contribute and benefit from 
a reengineered system. 

A. STRATEGIC INTELLIGENCE IN THE HOMELAND 

The battles of terrorism are being fought both at home and abroad. 
Naturally, the definitions of strategic and tactical intelligence are somewhat 
different between local/state, some federal government agencies and military 
organizations. The line of demarcation is not drawn based upon the level of 
government that is involved in a particular operation or intelligence product but 
rather where the battle is being fought, at home or abroad. Mark Lowenthal 
offers the following goal for the intelligence community regarding strategic 
surprise, “keep track of threats, forces, events, and developments that are 
capable of threatening the nation’s existence.’’^ When a country, through its 
intelligence community keeps track of these types of elements it precludes 
strategic surprise. For example, if a country is attacked with a nuclear device 
when there has been no indication or information that any countries possessed a 
nuclear device. Conversely, if a country has knowledge of a specific capability 
possessed by a potential enemy that country can prepare to deny or respond to 
that specific capability or threat. This type of information and intelligence allows 
policy makers to make choices with regard to budgetary expenditures, defensive 
and preparedness activities. In the homeland security context, strategic 
intelligence is similar and directly supports detection, denial, disruption and 
preparedness efforts of the entities fighting the battle at home. Since the enemy 

^ Mark Lowenthal. Intelligence: From Secrets to Policy, 2"'^ ed. CQ Press, Washington. 2003. 

p.2. 
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is living, planning and operating within the boundaries of our country those 
responsible for fighting them must know what threats and capabilities exist with 
the enemy. 

Starting with the federal budget cycle of 2002 billions of dollars are being 
spent on state and local preparedness efforts alone. It only makes sense for 
those state and local first responders to be provided the strategic intelligence that 
will shape their training and preparedness efforts. What is the capability of the 
enemy? What are the types of attacks that they will plan next? It is senseless to 
prepare for a method of attack that will never occur but shameful to fail to 
prepare for an attack that has been predicted. Even more shameful is if the 
prediction, or capabilities of the enemy, was never shared with those who could 
prevent it or may have to respond to its consequences. The moral obligation not 
withstanding, the fiscal oversight alone should demand that our capacity to 
prevent and respond is being built based upon accurate information. 

To state and local governments the strategic intelligence answers the 
questions of capability and intent. Would the enemy attack at a sporting event, a 
mall or a mass transit venue? Or does the enemy prefer to strike the electrical 
power grid, petroleum transmission pipelines or telecommunications hubs? Is 
their desire mass casualties, mass disruption, or mass confusion? Once intent 
and possibly the method of operation is established then the question is can they 
do it? Does the enemy have the capability to act out their intentions by the 
methods they choose? What does history tell us, and has this enemy attempted 
this type of attack before and what were the results? These are the questions 
and types of information or strategic intelligence that state and local governments 
need in their preparedness and fight against terrorism. With limited resources 
and an unlimited number of potential targets and methods of attack, strategic 
intelligence is a necessary requirement for state and local counterterrorism 
efforts. 
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B. TACTICAL INTELLIGENCE IN THE HOMELAND 

Since the enemy, or least some number of the enemy’s operatives are 
living in the cities and neighborhoods in America, who is best positioned to be the 
eyes and ears of the Intelligence Community? The answer is the hundreds of 
thousands of local and state officials that are working in those communities 24 
hours a day seven days per week. One can then add to that number the untold 
number of workers in industries regulated by state and local governments that 
have regular, mandatory reporting requirements to those authorities. Regardless 
of whether the strategic intelligence indicates that the enemy is desirous of an 
attack on critical infrastructure, key assets or venues congregating thousands of 
people in one place, local and state officials have access to those local 
information sources to report and/or develop the tactical intelligence. 

Tactical intelligence in the homeland security environment is more specific 
and when combined with other pieces of information may reveal plans of attack, 
methods of attack or the location of terrorist cells in a community. With this kind 
of intelligence reported from countless local and state sources, federal agencies 
can “connect the dots” on a regional and national level, while state level 
intelligence organizations can piece together information that may not have as far 
reaching impacts. 

The following case study shows that the specific or tactical level 
intelligence most often will be reported and developed at the local and state level. 
The strategic intelligence however was arguably provided by the federal 
government in the form of a raised threat level and statements by U.S. officials 
that Al Qaeda operatives were in America subsequent to the attacks of 9/11. 
Additionally, the case study shows the necessity for a single point of contact for 
the federal government, a single point of contact for other state resources and 
why states need capability to conduct their own intelligence operations. The 
case is known as Alligator Alley and it happened exactly one year after the tragic 
events of 9/11. 
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C. ALLIGATOR ALLEY 

During the period of September 12-13, 2002 the states of Georgia and 
Florida became involved in what was to be one of the most highly publicized and 
highly controversial “terror alerts” that has occurred since the war on terrorism 
began September 11, 2001.^ At 11:10 a.m. on September 12, 2002 a telephone 
call was forwarded to an agent of the Georgia Information Sharing and Analysis 
Center (GISAC) by the Calhoun Post of the Georgia State Patrol. The caller was 
a middle aged nurse, Eunice Stone, who reported to the agent that she and her 
son, just twenty minutes earlier, had left the Shoney’s restaurant at Interstate 75 
and Redbud Road in Calhoun, GA where she overheard the conversation of 
three “Middle Eastern males” that gave her cause for concern. 


® The following account is based on press coverage, including in particular the articles cited. 

(Dennis S. Mileti and John H. Sorensen. Communication of Emergency Pubiic Warnings: A 
Sociai Science Perspective and State-of-the-Art Assessment. Prepared for the Federal 
Emergency Management Agency by the Oak Ridge National Laboratory. Oak Ridge, Tennessee, 
August 1990. 

“Eunice Stone’s conversation this morning with Fox News.” Caihoun Times, 13 September 
2002. Available from 

http://news.mvwebpal.com/news tool v2.cfm?pnpid=722&show=archivedetails&ArchivelD=8569 

70&om=1 . Accessed 26 April 2003. 

“Man in Terror Scare says Woman is Lying.” CNN.com/U.S., 13 September 2002. Available 
from http://www.cnn.eom/2002/LIS/09/13/alliqator.allev/ . Accessed 3 February 2003. 

Chapman, Dan and Mike Williams. “Three Men Stopped in Florida after Woman Reports 
Threat: Authorities Think Remarks may have just been a Joke”, ajc.com The Atianta Journai- 
Constitution, 14 September 2002. Available from 

http://www.accessatlanta.com/aic/news/09/02/14termain.html . Accessed 3 February 2003. 

Goshier, Elijah. “A Greater Threat to U.S. Security: Our Prejudices.” St. Petersburg Times 
Online Floridian, 24 September 2002. Available from 

http://www.sptimes.eom/2002/09/24/news pf/Floridian/A greater threat to U.shtml . Accessed 3 
February 2003 

Dahiburg, John-Thor and Stephan Braun. “Florida Is Gripped by Terrorist Scare Tension: 
Comments Sets off of Massive Police Response.” Los Angeies Times, 14 September 2002. 
Available from http://www.sidhnet/com/sidhnet/discussion.nsf . Accessed 2 February 2003. 

Green, David and David Kidwell. “Federal Investigators Checking Three Men who reported 
‘America would cry on 9/13’.” Miami Heraid, 13 September 2002. Available from 
http://www.miami.com/mld/miamiherald/4066947.htm . Accessed 3 February 2003. 

Randall, Kate. “The Florida ‘Terror Attack’ That Never Was: A Study In Media Hysteria, Anti- 
Muslim Bigotry and Police Abuse.” Worid Socialist Web Site, 25 September 2002. Available from 
http://www.rense.com/general29/911oops.htm . Accessed 3 February 2003. 
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stone reported that she and her son were seated in the restaurant 
adjacent to the three men and overheard them making the following statements 
in a low volume: “I don’t know if that much can bring it down”; and “they mourned 
September 11*^, they are going to mourn September 13‘^ as well.” Stone further 
reported that the three men mentioned they had been partying in Chicago the 
previous day in celebration of September 11, 2001, and they were five hours 
behind schedule in their travel to Miami, Florida. As the men left the restaurant. 
Stone noted that they paid with a credit card and two of the men got into a cream 
colored Nissan Maxima and the other entered a black newer model Honda, both 
vehicles displayed Illinois license plates, one of which she was able to record, 
and were last seen entering Interstate 75 southbound. This summary was the 
initial information that was reported to law enforcement authorities by Stone. 

GISAC immediately began to verify the information that had been provided 
to authorities and at 11:45 a.m. GISAC called the Florida Department of Law 
Enforcement (FDLE) to advise them of the conversation with Stone. Computer 
checks of the tag number came back with no information, the tag was not on file 
in the national database. GISAC contacted Stone to verify the tag number, which 
she did. At 2:50 p.m. authorities in Florida were advised by officials with the 
Illinois Attorney General’s Office that their local information revealed that the tag 
number should be displayed on a 1997 Buick four-door sedan and that the owner 
was of a Latin surname, Munoz. At 3:30 p.m. Georgia authorities interviewed 
employees of the Shoney’s restaurant, retrieved the credit card information from 
the transaction of the three men and re-interviewed Eunice Stone. Law 
enforcement authorities were unable to secure video tapes from Shoney’s to 
corroborate Stone’s report. At 5:30 p.m. a lookout, to law enforcement, for the 
cars and the men was issued, by authorities in Florida. At 6:15 p.m. that same 
lookout was rebroadcast in Georgia to law enforcement officials only. 

At 11:30 p.m. a Collier County, FL deputy sheriff stopped the cream 

colored vehicle for running through a toll booth eight miles from Interstate 75 on a 

highway known as Alligator Alley. The black vehicle traveling in tandem pulled 

over behind the deputy and the cream colored vehicle, and the deputy called for 
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backup assistance. Within minutes, scores of law enforcement officers arrived 
on the scene and the scenario that played to a national audience was starting to 
play out. The manhunt was over, but the investigation and public critique was 
just beginning. 

Before the men were released, an in-depth investigation in at least three 
states went forward over the next seventeen hours. Following are some of the 
results of the investigation, some of which gave suspicion to investigators and 
lent credibility to the belief that the men may have had evil intent. At a minimum 
some results gave reason to believe that criminal activity may have been afoot. 
Two separate bomb dog teams alerted on the trunks of both vehicles. While 
certainly within their constitutional rights, the men refused a consensual search of 
their vehicles. One of the men made the statement, “you stopped us because of 
what we said at that restaurant up in Georgia”. The first interviews with the men 
were characterized by police as “uncooperative” and their statements did not 
corroborate each other. 

In the end, there was no evidence that the men were terrorists or that they 
were engaged in any plot, conspiracy or plan to harm anyone. The conflicting 
vehicle tag information was investigated and explained, the motel rooms where 
they stayed were clean, the credit card information checked out with no 
abnormalities and citizenship and visa information were substantiated. Even the 
report that one of the cars failed to pay the toll booth was inaccurate, as video 
footage revealed that both cars did, in fact, pay the tolls and the $126 dollar ticket 
had to be voided. 

Step back in time to the dates of this incident, September 12-13, 2002. 
The one-year anniversary of the most devastating terrorist attack against civilians 
on American soil had the country feeling uneasy about the security of the 
homeland. For the first time since the development of the color-coded Homeland 
Security Threat Advisory System, the nation had been placed on an increased 
level of alert, orange (high) from a yellow (elevated) only a few days earlier. 
National leaders and the press did not name any specific information that led to 
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the increase in the threat level but did advise law enforcement agencies to 
maintain a “heightened state of awareness” although no specific instructions 
were given on how to meet this expectation. The people were told to go about 
their business as normal but to “be aware of [their] surroundings” and to “report 
any unusual activity to local law enforcement authorities.” Many speculated that 
terrorists might attempt another attack on or near the anniversary of 9/11. The 
Federal Emergency Management Agency had firmly requested that the state 
emergency management agencies report to them any events where large 
gatherings of people were expected to assemble the week prior to the 
anniversary. Many people were anxious. It was in this environment, that Eunice 
Stone called the police. 

D. LESSONS LEARNED CONCERNING REQUIREMENTS 

The first point to make relative to this case study is that the information 
was developed locally. Although the men were exonerated, they just as easily 
could have been terrorists planning an attack or individuals on the FBI’s terrorism 
watch list. The information did not come from spy satellites, telephone 
intercepts, or a prison cell in Guantanamo Bay, it came from local sources. The 
Attorney General, the FBI Director and any number of terrorism experts have told 
us repeatedly that the enemy is here, on our soil, in our country and is living 
among us. That was certainly the case with the hijackers of 9/11; two had been 
living in my hometown, Atlanta, Georgia!^ Today, with this enemy there will be 
domestic and foreign sources of information that may need to trigger a warning. 
Authorities must recognize this fact and reengineer a system to incorporate the 
invaluable contribution of local inputs. 

Secondly, there must be a one-stop-shop to gain the assistance of the 
federal government for checking the status of people on various federal data 
bases that are not available to state and local authorities. Prior to the 
establishment of the federal Department of Homeland Security “nine federal 
agencies [that] spanned five different cabinet-level departments [maintained] 

^ Dave Hirschman. “Flight School Owner Rues Day He Saw Terrorists”. Cox News Service. 

11 September 2002. 
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twelve terrorists and criminal watch lists.”''° Currently in Georgia, the GISAC 
checks all information through the FBI managed Joint Terrorism Task Force 
(JTTF) located one floor below the offices of GISAC. The JTTF has in residence 
a myriad of federal agency representatives that have access to their own 
databases and can check and verify information submitted by GISAC officials. 

Additionally, there is a need for states to have a clearinghouse that the 
federal government or another state can use to avoid lengthy delays in obtaining 
information. Luckily, in this incident the states that were called upon had offices 
that “ran interference” in their own state and were able to obtain vehicle and 
driver information for the agents at GISAC. What would have happened if these 
states did not have a central point of contact? What would have happened had 
the case been more complicated and rather than the suspicion of an explosive 
devise there was the suspicion of the intentional poisoning of the food supply, a 
cyber attack on the power grid, or a biological agent? Would there have been a 
state point of contact that could have provided the necessary information and 
contacts required to disrupt the threat in time? The states desperately need 
Information Sharing and Analysis Centers to accommodate these types of 
demands for information exchange on a full time basis. 

E. REQUIREMENTS TO DEVELOP STATE/LOCAL INTELLIGENCE 

In the environment after 9/11 states also must be able to provide their own 
capability to gather, examine, and investigate information. In the days and 
weeks after the attacks and the subsequent legitimate and hoax anthrax events 
in the fall of 2001 most public safety organizations were bombarded with calls 
reporting every imaginable suspicious scenario. While most of these well 
intentioned reports by the public were of little value, there were some reports that 
warranted further investigation and yielded information that was beneficial to 
public safety officials. In these instances where people called local and state 
authorities to report suspicious behaviors and circumstances they believed to be 

Robert F. Dacey and Randolph Hite. Testimony Before the Committee on Government 
Reforms, House of Representatives. Homeland Security: Information Sharing Responsibilities, 
Challenges and Key Management Issues. United States General Accounting Office, 8 May 2003. 
p.34. 
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indicative of terrorists’ plots or the location of members of terrorist cells, federal 
agencies could not have handled the volume. Not only was the sheer volume a 
problem but the criticality and reliability of the information was not of the level that 
most federal law enforcement and intelligence organizations require prior to 
taking some sort of action. 

Further, states should develop the capacity to provide their own policy 
makers with intelligence to enable them to perform the necessary homeland 
security duties at that level. As previously mentioned, billions of dollars have 
been awarded to states to enhance homeland security efforts. Each state has 
varying threat elements, vulnerabilities and capabilities to respond to an act of 
terrorism. In the current environment, states must have the capacity to scan the 
environment and produce intelligence products to policy makers that will facilitate 
directing resources in an appropriate manner. Additionally, there are special 
events that take place in a jurisdiction that may or may not attract the support of 
federal agency intelligence resources. Even if federal resources are engaged, 
state officials may be prohibited from accessing those intelligence resources due 
to security clearance restrictions. Also, differences in missions require that the 
state be able to provide its own intelligence for policy makers for a particular role 
or event. 

In the upcoming G8 Summit to be held in Georgia, the state and federal 

roles for that event are markedly different. As will be discussed in more detail 

later in the next chapter the intelligence resources of the federal and state 

governments have been somewhat combined in an effort to fuse information. 

Even with this cooperative effort the missions assigned to each level of 

government and each agency involved require different information and different 

intelligence. For example, the United States Secret Service is the lead federal 

agency and is primarily concerned about dignitary protection in a few very finite 

areas called venues many of which are extremely isolated by the ocean and 

difficult to maneuver terrain. The state of Georgia, however is concerned that 

since the venues are virtually inaccessible would be protestors will choose to 

stage protests in locations far removed from the venues. If this occurs, it is the 
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problem of state and local governments to manage. Thus, the need for 
intelligence information to assist in determining if the protestors will choose a 
different site, whether or not they have a potential for violence and how many 
there will be. The intelligence requirements for distinct missions are different. 

F. CONCLUSION 

State and local governments do have a role in the new homeland security 
intelligence efforts. Hundreds of thousands of eyes and ears in local 
communities can provide valuable information to the states for statewide 
intelligence trends and to the federal government for developing regional and 
national tactical intelligence. The states have a need for strategic intelligence to 
make wise resource allocation decisions and tactical intelligence to know where 
the enemy is residing and what plans and capabilities they are amassing. States 
also need fulltime ISACs to assist other states in investigating fast breaking 
incidents, like Alligator Alley and to issue warnings to thwart potential attacks. 
This capability should be robust should the incidents be more complex and 
involve disciplines other than law enforcement. 

The state of Georgia has developed this type of capability. The Georgia 
Information Sharing and Analysis Center was created shortly after 9/11 and has 
fulfilled one of the missions previously lacking in our state. From a meeting held 
the Sunday after 9/11 to the critical role GISAC is playing in preparations for the 
G8 Summit, the creation, successes and future challenges of GISAC are 
described in the next chapter. 
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III. THE GEORGIA INFORMATION SHARING AND ANALYSIS 

CENTER 


After 9/11 Public Safety officials in Georgia recognized that terrorists had 
infiltrated our country and were living, planning and launching attacks against us 
from our own cities and neighborhoods. These officials immediately predicted 
the tremendously important role that state and local governments would have to 
play in the prevention of future terrorist attacks. This chapter will discuss the 
establishment of a statewide information sharing and analysis function in Georgia 
and examine key issues addressed that ensured the success of this newly 
created capability. Several examples will be used, in the form of case studies, to 
validate certain fundamental principles that were established early on in the 
development of this newly created unit. Specifically to be examined is the 
organizational structure of the unit itself and more broadly the reporting structure 
of the unit to high ranking public safety officials in state government. These initial 
decisions and founding principles will prove to be essential to the success of this 
newly established organization. Finally, I will discuss future challenges relating 
to maintaining the integrity of founding principles and embracing expanded roles 
like the involvement with the intelligence function in planning for the Group of 
Eight Summit (G8). Maintaining core values will prove to be critical as success of 
this new capability is attracting new partners to the arena. 

A. CREATION OF GISAC 

On October 25, 2001, the state of Georgia launched its effort into the 
terrorism intelligence arena by establishing the Georgia Information Sharing and 
Analysis Center (GISAC). Obviously, the creation of this state level “terrorism 
intelligence” unit was in direct response to the terrorist attacks that occurred in 
America on 9/11. This visionary effort was initiated prior to the issuance of any 
national guidance or strategies suggesting that the states would or should be 
included in an intelligence or information sharing role within the context of 
Homeland Security. 
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The impetus for establishing this unit was the direct result of a meeting 
conducted on Sunday, September 16, 2001 between a small group of state level 
law enforcement and emergency management officials at the headquarters of the 
Georgia Emergency Management Agency in Atlanta, Georgia.'''' The purpose of 
this meeting was to formulate a plan for the state’s involvement in the fight 
against terrorism and to provide to the Governor that plan and a budget for 
implementation. It is interesting to reflect upon this meeting to examine the initial 
recommendations made by this small group concerning the needs for the state of 
Georgia and compare them to the efforts articulated in the National Strategy for 
Homeland Security. To be sure, the National Strategy for Homeland Security is a 
much more comprehensive document than is the plan initiated by the small group 
that Sunday afternoon but some of the initial conclusions were strikingly similar in 
the themes that were developed. Recommendations were made to enhance 
communications and collaboration with the private sector regarding critical 
infrastructure, employing more planners for tactical level planning to ensure the 
best possible state response should an act of terrorism occur in Georgia, 
ensuring that communications systems were sufficient to provide timely 
warnings, and to “get back into the intelligence business, so we will know what’s 
going on in our own backyard”.''2 Even then, arguably that group was addressing 
four of the six critical mission areas that would be published in July of 2002 in the 
National Strategy for Homeland Security, domestic counterterrorism, protecting 
critical infrastructure, and emergency preparedness and response, and 
intelligence and warning.'"^ Georgia was about to “get back into the intelligence 
business” but many things would have to happen before the GISAC would 
become the critical prevention tool for the State of Georgia that has become. 

One such matter occurred on October 25, 2001 when Governor Roy 
Barnes named the state’s first Homeland Security Coordinator, empanelled the 
Georgia Homeland Security Task Force and created the GISAC and its reporting 
'''' The meeting referenced was attended by the author. 

''2 Remarks cited, with permission, during that Sunday meeting by Vernon Keenan, Director 
of the Georgia Bureau of Investigation. 

National Strategy for Homeland Security, Washington, D.C.: July 2002. p. viii. 
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relationship to the Task Force.Here I will discuss the importance of these 
executive actions and subsequent gubernatorial actions and executive orders 
that contributed to the success of GISAC. The unique reporting relationship of 
GISAC to the head of the state homeland security effort and to the members of 
the Task Force has enabled and facilitated information sharing envious to most 
communities desirous of intelligence capabilities. 

Below we will take a journey through the two and a half years existence of 
GISAC from the initial decisions regarding the mission of GISAC through the 
current involvement the unit has in developing intelligence and providing 
information to policymakers in preparation for the Group of Eight (G8) Summit to 
be held on Sea Island June 8-10, 2004. Additionally, the necessity to create this 
unit occurred during the middle of a state budget cycle. How would it be staffed 
and funded? Where would the GISAC be physically located and what other 
challenges would lie ahead? Once established the GISAC would achieve some 
successes and be beneficial to other efforts including the G8 Summit and other 
high profile events such as meetings of the Free Trade Association of the 
Americas (FTAA). 

B. THE MISSION OF GISAC 

It is important to recall the days immediately following 9/11 and how the 
mood and activities of public safety officials were dominated by this 
unprecedented event. Because there had been almost no capacity at the state 
level for terrorism intelligence activities and very little support for even minimal 
criminal intelligence efforts, officials were seeking a way to not only develop 
information on terrorists who may be living in their jurisdiction but also to 
scrutinize the plethora of information that was being received through local, 
federal and media channels. One specific example that emphasized the need to 
initiate a state-level unit that would be central to all available terrorism 
intelligence and to serve as the clearinghouse for which all terrorism information 


Maurice Tamman and Duane Stanford, “Barnes Planning Anti-Terrorism Intelligence 
Center for Georgia,” Atlanta Journal-Constitution. 26 October 2001. 
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should funnel is a meeting called by the Special Agent in Charge (SAC) of the 
Atlanta Office of the Federal Bureau of Investigation (FBI). This office serves as 
the headquarters for all FBI activities in the state of Georgia. 

Many public safety officials in Georgia, especially within the non-law 
enforcement disciplines, enjoy a collegial, inclusive, cooperative relationship with 
the Atlanta office of the FBI. Prior to and since 9/11 it was commonplace for the 
FBI to include state and local officials in meetings and workgroups where 
interagency protocols and plans are developed for various types of responses. 
Many of these relationships, both organizational and individual, date back to the 
public safety preparations for the Centennial Olympic Games held in Georgia in 
1996. 

Within days of the attacks of 9/11 the SAC of the Atlanta Office of the FBI 
called a meeting with all jurisdictions of local and state law enforcement agencies 
that comprise the Metropolitan Atlanta Area. The purpose of that meeting was to 
relay information to that group on the existence of “raw” intelligence information 
that specified Atlanta as a target of Al Qaeda terrorists. The information was that 
tall buildings and sports facilities might be the objects of an attack. It was 
stressed that this information was raw and unverified and that efforts were 
underway to verify the credibility of the information. It was further communicated 
that regardless of the security clearance status, or lack thereof, of the local and 
state law enforcement community; the FBI would pass along information that 
posed a threat to the population of the City of Atlanta and of the State of Georgia. 
Two days after that meeting all of the attendees were personally contacted and 
informed that after thorough investigation the information had not only been 
determined to be “not credible” but in fact had been fabricated."is 

Despite the excellent relationship that is enjoyed with the FBI in Georgia, 
common sense dictated that a meeting would not be called every time there was 
intelligence to be shared and that at some point there would be information that 
the state did not receive that we thought to be important. Further, the State felt 

The author was present at the meeting September 14, 2001, see also: Maurice Tamman, 
“Terrorist Plot to Hit Atlanta Proves a Hoax,” Atlanta Journal-Constitution, 13 December 2001. 
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like there may be instances where we had the duty to share information with 
jurisdictions that were not at the table and would not be able to get the 
information in a timely manner. Additionally, we highly suspected (and it was 
later confirmed) that members of Al Qaeda were living and planning in our own 
backyard. Therefore, we needed to utilize every resource available through state 
and local governments to develop, analyze, and investigate all information on 
potential terrorists to deny and interdict their activities. Finally, we understood 
the limited resources and constraints upon the federal government and the 
intelligence community and knew that in the future state and local governments 
would play a vital role in the collection and development of terrorism intelligence. 
Since terrorists have infiltrated our country and are living among us, those best 
positioned to gather information are the people working in every local community. 

With these assumptions and facts being considered the mission of the 
GISAC was formed and is articulated in internal documents as follows: 

The mission assigned to the GISAC project was to serve as the 
focal point for the collection, assessment, analysis, and 
dissemination of terrorism intelligence information relating to 
Georgia. GISAC was not intended to replace or duplicate the 
counter-terrorism duties of the Federal Bureau of Investigation, but 
rather to enhance and facilitate the collection of intelligence 
information from local and state sources, and to integrate that 
intelligence information into a system that will benefit homeland 
security and counter-terrorism programs at all levels. 

Soon after it began operations, GISAC established itself as the 
state’s clearinghouse for terrorism-related intelligence information. 

It quickly developed protocols and relationships that enhanced its 
capabilities for the gathering, assessment, analysis, exchange, and 
dissemination of intelligence information between local, state, and 
federal government agencies; corporate security executives; and 
the private sector owners and operators of critical infrastructure 
assets.''® 


''® Georgia Homeland Security Task Force. The Georgia Information Sharing and Analysis 
Project. Atlanta, Georgia, p. 2. 
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C. STAFFING AND HOW THE MISSION IS ACCOMPLISHED 

1. Staffing 

Although the Georgia Bureau of Investigation (GBI) manages the GISAC 
five other organizations contribute personnel that fill the seventeen positions at 
GISAC. And while these are the only full time employees of GISAC numerous 
state agencies and private businesses provide twenty-four hour points of contact 
for individuals expert in their field who can provide technical expertise toward the 
efforts of GISAC. For example, the Division of Public Health provides contacts 
that facilitate information exchange between epidemiologists and GISAC 
regarding bio terrorism information and disease surveillance information that may 
have intelligence value. The Georgia Department of Agriculture provides on call 
personnel to liaise with GISAC concerning agroterrorism issues. The Georgia 
Technology Authority assigns network security officers to dialog with GISAC 
personnel to inform of concerns relating to potential cyber security threats and 
attacks. This capacity is similar to and is modeled after emergency management 
organizations that manage recovery efforts through emergency operations 
centers. Those centers are staffed with personnel from various agencies who 
are able to commit resources on behalf of their agency toward recovery efforts 
subsequent to a natural disaster. During non-disaster periods, the same 
personnel provide planning and training assistance to the emergency 
management agency in preparation for eventual disasters. Similarly, GISAC 
counts on “adjunct” personnel or trusted partners. They are not physically 
present in the office but are available to provide technical assistance, information 
and coordination within their area of expertise, when needed. 

The full time employees of GISAC, their respective assignments and 

parent agencies are listed below: 

Georgia Bureau of Investigation 
Inspectors - 1 

Special Agents in Charge - 1 
Assistant Special Agents in Charge - 1 
Intelligence Analysts - 2 
Special Agents - 6 
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Georgia State Patrol 
Investigators / Analysts - 1 

Georgia Emergency Management Agency 
Critical Infrastructure Analysts - 2 

Georgia National Guard 
Intelligence Analysts - 1 

Georgia Sheriff’s Association 
Investigators/Agents - 1 

Georgia Association of Chiefs of Police 
Investigators/Agents - 1 

2. Reporting and Chain of Command 

As mentioned earlier, the GISAC was created on October 24, 2001 
simultaneously with the Georgia Homeland Security Task Force and the 
appointment of the state’s Homeland Security Coordinator. There is one 
additional action, an executive order issued on March 13, 2003 that directly 
impacts the reporting status of the GISAC. The subject of both executive actions 
(one an announcement and one a formal executive order) was to establish the 
framework for how the homeland security efforts were to function in the State of 
Georgia. Conseguently, however, each order effected GISAC; the first of course, 
more than the second. It is, however, important to understand the political 
environment and circumstances of both executive orders and their implications 
upon the chain of command. 

Each executive decision was issued by a different Governor as the 
gubernatorial elections held in November 2002 changed the majority political 
party in Georgia for the first time in 135 years. Naturally, this change in political 
power prompted changes in leadership within some agencies of state 
government. Public safety agencies represented on the Homeland Security Task 
Force were not exempted from these changes and indeed the person who had 
previously been the coordinator of the Homeland Security Task Force resigned. 
Although change was implemented regarding the Homeland Security function, 
the GISAC model and many of the players remained the same and the mission 
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has been left intact. The first or enabling executive action was issued under an 
administration that chose to have a position entitled Commissioner of the 
Department of Public Safety. The Commissioner was among the highest levels 
in state government and commanded a large majority of the state’s law 
enforcement resources; many referred to the position as the Supercop. Among 
the agencies that reported to the Supercop were: the Georgia State Patrol, the 
Georgia Bureau of Investigation, the Criminal Justice Coordinating Council, the 
Capitol Police Services, and various smaller entities. Germane to this subject, 
however, is that the Supercop was also named as Coordinator of the Georgia 
Homeland Security Task Force in that first announcement that enabled the 
creation of GISAC and the Homeland Security Task Force. 

The chain of command that was established for the GISAC at its inception 
was that the unit and its commander reported to the Coordinator of the Georgia 
Homeland Security Task Force, who at the time was the Commissioner of the 
Department of Public Safety, or Supercop. Even though the commander, at the 
time, was the rank of Special Agent in Charge (SAC) employed by the GBI the 
unit was created as an equally subordinate entity to the Coordinator of Homeland 
Security and the GBI, therefore the SAC reported directly to the Supercop. Had 
the unit not been established as its own entity this reporting arrangement could 
not have been implemented as it skipped at least four levels of management 
within the GBI and would have violated even the most liberal interpretations of 
chain of command. 
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Original Reporting Structure of GiSAC 
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Figure 1. Original GISAC Organization Chart 


The second gubernatorial action was in the form of an executive order 
signed March 13, 2003 and was issued by a different governor. This order 
changed the structure of Homeland Security in Georgia. Even prior to that order, 
however, the Governor had accepted the resignation of the Homeland Security 
Coordinator/Supercop and decided to abolish the position of Supercop. Instead, 
he changed the reporting hierarchy of all state agencies toward a cabinet type of 
structure comprised of six cabinet positions. One of those cabinet positions is 
the Director of the Georgia Office of Homeland Security. Currently, except for 
matters pertaining to Homeland Security, neither the GBI nor any other law 
enforcement agency report directly to the Director of Homeland Security. The 
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GISAC, however, does report directly to the Director of Homeland Security and 
this reporting arrangement was dictated by the second executive order. The 
Inspector in charge of GISAC still reports directly to the state head of Homeland 
Security, but it is a different political situation all together. Now, rather than 
reporting to his boss’s boss three levels removed (a very awkward situation), he 
reports to the head of an entirely different cabinet organization. As it stands 
today, the entity of GISAC is an asset of the Georgia Office of Homeland Security 
but it is staffed by individuals employed by other agencies as listed above. Even 
through political transition a founding principle of GISAC has remained intact; the 
unit must have unobstructed access to the head of the state’s Homeland Security 
structure. 


Reporting Structure of GISAC After Creation 
of the Georgia Office of Homeland Security 



Figure 2. Current GISAC Organization Chart 


D. HOW DOES GISAC WORK AND WHAT DO THEY DO? 

Consistent with its mission statement the primary role of GISAC is “to 
serve as the focal point for the collection, assessment, analysis, and 
dissemination of terrorism intelligence information relating to Georgia.”''^ The 
mission of GISAC was directly influenced by the many concerns enumerated 
Ibid. 
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earlier in this text. One concern was that many different state and local agencies 
had to juggle multiple sources of information. These sources of information 
included organizations in both the public and private sector. Additionally, there 
existed a fear that meetings previously held for the purpose of disseminating 
information would be curtailed and the state would miss out on critical 
information. Further, leaders in the state believed that they had the responsibility 
to make independent determinations and evaluations regarding terrorist 
information. Therefore, the state of Georgia decided to put our flag out 
proclaiming, “here is where you deliver information concerning terrorism 
intelligence” and likewise “if we have anything to tell you about terrorists’ 
activities, it will be told from here.” In other words, this GISAC is going to be our 
one stop shop for terrorism intelligence. In addition to being the focal point for 
intelligence in the State of Georgia, GISAC also facilitates collection of 
intelligence from local law enforcement and non-law enforcement sources, 
investigates information obtained, analyzes information, makes determinations 
on information dissemination, and produces certain products for customers. 

Upon establishing GISAC it was important for the management to 
publicize its existence in order to facilitate the collection of information from the 
vast local sources available in Georgia. Those vast sources and the sheer 
number of local jurisdictions in the state complicated the effort in spreading the 
word of GISACs creation and mission. There are 159 counties, over 650 
municipalities and 40,000 certified peace officers in Georgia. The sheer volume 
of potential inputs into GISAC is staggering but is also testimony as to why state 
and local governments must be involved in the collection of terrorism intelligence 
information. Over forty thousand eyes and ears in the field; and that is just the 
certified peace officers not including all of the other government workers serving 
in those communities who can also be trained to gather information! 

Through many associational meetings, personal visits, teletype 

broadcasts, training conferences and word of mouth the creation of GISAC 

reached a majority of the organizations that needed to know of its existence. 

While most of the call volume is handled by the existing staff, overnight reporting 
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and overflow calls are processed by the call center staffed by the Georgia 
Emergency Management Agency which is transparent to the caller. On call 
GISAC staff members are immediately notified of inputs or messages that require 
urgent attention. 

Obviously, one of the primary roles performed by GISAC is to investigate, 
analyze and make a determination regarding the wide variety of information that 
is reported. The managers at GISAC are fortunate in that they have been given 
the authority to task any active GBI agent, in the furtherance of an 
investigation.'IS This is a critically important capability allowed by the Director of 
the GBI because of the large geographic area of the state. There are areas of 
the state that are as much as six hour drives from Atlanta, the headquarters of 
GISAC. The ability to task GBI agents, assigned to field offices in all areas of the 
state, ensures timely responses to incidents that require immediate investigative 
attention. Most information that is reported can be examined, investigated and 
cleared from the agent’s desk in a minimal amount of time, while other cases are 
extremely complex requiring extensive investigation, analysis and ultimately the 
issuance of an alert. 

An example of a simple yet interesting case occurred shortly after the unit 
was established. I actually received a call from an official with the Georgia 
Department of Agriculture who stated his concerns to me regarding an applicant 
for a vacant food inspector position. The applicant had persistently called 
inquiring about the status of his application for the position and was extremely 
interested in securing that particular job. The concern of the manager was that 
the qualifications of the individual applying were well above the required 
education level, as he had a Doctor’s degree in Chemistry from a University 
located in a certain Middle Eastern Country. The manager explained to me that 
the job had been awarded to another more suitable candidate, but the 
persistence of this particular individual toward a job for which he was incredibly 
overqualified, had raised suspicions of the candidate’s true intent. Because this 

Interview with Inspector Bob Hardin, Commander of GISAC, 26 January 2004. 
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occurred so early on in the establishment of GISAC and all of the agency contact 
information had not been developed, the manager asked that I forward the 
information to the appropriate person. This was good information to pass along 
as the applicant had provided a substantial amount of personal and contact 
information through his resume. As far as I or anyone associated with GISAC 
knows, the individual was determined to be clean and was not linked to any type 
of terrorist activity but had there been a law enforcement or federal government 
interest in this person they now had the information to locate him. The role of the 
GISAC in this case was merely to document the information, forward the resume 
to the FBI and ask them to run a check on the person. In this instance the 
system worked and was an example of a simple flow of information to the 
appropriate point and a computer check of the individual. Other cases, however, 
become much more complicated and demonstrate the value of having agencies 
that do not normally work together being involved in a collaborative effort to 
develop intelligence. 

The involvement of GISAC in case of a Nigerian man attempting to 
fraudulently purchase vital records is an example of how federal, state and local 
authorities worked together to identify, collect and develop intelligence 
information. Additionally, this case was prompted by a “non-traditional” member 
of the GISAC system; an employee from the state’s Vital Record Section of the 
Division of Public Health. Through the adjunct staff (or trusted partner), GISAC 
was notified of an individual that was attempting to order a birth certificate on a 
child who was deceased. GISAC personnel queried the databases they had 
access to and requested that their federal contacts do the same to see if the 
individual who had requested the birth certificate was a fugitive or was on any 
particular watch list. After the various checks yielded no meaningful information 
and was negative for the person being on any “wanted list”, GISAC personnel 
invited federal and local partners to participate in a controlled delivery of the 
requested birth certificate. Therefore, instead of denying the man access to the 
illegally requested item, the item was delivered to him while law enforcement 
officials monitored each step of the process. Upon the delivery and receipt of the 
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birth certificate the man was arrested and his residence searched. Below is an 
excerpt from the summary of the incident found in the intelligence bulletin 
prepared by GISAC. 

[The man] initially claimed to be William Luther Smith and produced 
a Georgia driver’s license, a social security card and an active 
United States Army Identification supporting his claim. Later, 
during an interview, [the man] admitted that William Luther Smith 
was not his true identity, but that he was presently active in the 
United States Army in an Intelligence Unit stationed in Korea under 
the false identity. [The man] stated that he had been in the 
Nigerian Military. Officers found photographs in the apartment of 
[the man] in his Nigerian Armed Services uniform as well as in a 
United States Army uniform. [The man] was taken into custody on 
forgery charges.... Officials from the United States Army were 
notified and are also investigating the incident.''^ 

Again, this example shows the need to have a system that accommodates 
information that is obtained locally and by “non traditional” partners. The man did 
not live in Spain or North Africa; he lived in Georgia. Further, it demonstrates the 
need to include all levels of government in the intelligence process. In this case 
the Vital Records Section could have just denied the request; end of story. 
Instead, the employee passed the information along to someone who could get 
access to a system that could investigate it further. Then, once the information 
was gathered and the suspect was arrested the State could have just processed 
the case like any other case but they did not. They called in the appropriate 
federal and military authorities to investigate further. Would that have been done 
five years ago? Probably not. Would any of this have been done five years ago? 
No, but 9/11 changed the world and it is changing the way people and 
organizations work together and the participants in the intelligence community. 

Whether the investigation is simple or complex GISAC is the agency that 
processes terrorism related information in the State of Georgia. Therefore, 
GISAC must determine the appropriate disposition of the information that is 
processed through the Center. Possible dispositions include further investigation 

Georgia Office of Homeland Security. Intelligence Bulletin, Issue 21, September 2003. 
Atlanta, Georgia, p. 1. The original document lists all of the agencies with personnel assigned to 
GISAC on a full time basis. 
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and inquiry of the information, attempting to develop the information or lead 
further, taking no action or filing the information or passing it to the federal 
authorities. The unique concept of GISAC is that all parties involved in the 
Center have an opportunity to influence the disposition of the intelligence and the 
information brought into the Center. Quoting from an internal GISAC document: 

After review by GBI supervisors, the ‘raw’ terrorism intelligence 
information is forwarded to GISAC’s [numerous, multidiscipline] 
representatives, who review it within the context of their own 
particular areas of interest and responsibility. The [various] 
representatives may subsequently recommend certain actions to 
GISAC supervisors and/or their own agency/organization managers 
in order to disrupt or prevent possible terrorist attacks, or to mitigate 
and manage the consequences of an attack.20 

It is officially a written part of the concept of operations to ensure that no 
information is withheld from various disciplines in the center due to agency origin 
or level of employment. My opinion is that the GEMA representatives have a 
particularly diligent responsibility in considering the impact of the information. 
The reason for this belief is that many disciplines and departments are not 
represented in the Center on a full time basis therefore GEMA must make a 
determination on their behalf. The other full time employees of GISAC are 
members of law enforcement agencies or the National Guard, therefore GEMA is 
expected to represent the interests of all other associated disciplines with regard 
to the information. 

As with all intelligence units the analytical function plays a vitally important 
role. The GISAC employs analysts who provide various types of analytical 
support to the agents and customers of the Center. Examples and descriptions 
of that type of support are as follows: 

• Fusing Information: Review and merge intelligence information 
with existing data in the intelligence system so that it may be 
analyzed. 

• Link Charting: Establish relationships among entities, individuals 
or organizations in an investigation. 


20 Georgia Homeland Security Task Force. Information Sharing and Analysis Project, p. 9. 
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• Event Charting: Show the chronological relationships between 
persons, organizations, and related events. 

• Flow Charting: Depict the flow of money, narcotics, weapons, 
stolen goods or other commodities through the elements of a 
criminal and/or terrorist network. 

• Activity Charting: Define the pattern or sequence of a terrorist 
operation, including modus operandi. 

• Telephone Toll Analysis: Condense large volumes of data into 
easy to read automated reports from which the significant 
telephone activity may be identified. 

• Case Analysis: Summarize intelligence information, investigative 
actions taken and the main findings associated with these actions, 
and the activities of the subjects. 

• Special Publications: Develop publications on various terrorism 
intelligence topics. The topics are determined by interest, 
availability of data and need for the information .21 

Other products are regularly produced and disseminated by GISAC. The 
first type of report that was developed and is still in use today is the monthly Law 
Enforcement Sensitive Report that is distributed to all law enforcement agencies 
in the state. These reports contain information, which is not classified but should 
not be distributed to the general public. Additionally, a weekly Open Source 
Report is provided to the member agencies of GISAC, fire departments and other 
agencies that have an interest in Homeland Security. This report is very 
informative as there are plentiful amounts of information obtained through public 
sources that is valuable to policy makers. The management of GISAC gives an 
intelligence briefing to the Georgia Homeland Security Task Force at every bi¬ 
weekly meeting as well as to the G8 planning group that meets weekly. And of 
course, when the need arises various alert bulletins are disseminated to 
organizations and to owners of critical infrastructure. Last, ongoing threat 
assessments concerning many groups and special events are provided to key 
leaders who have a need to know for purposes of planning security in and 
around these special events. 


21 Ibid., pp. 12-13. 
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E. FACILITIES - WHERE IS GISAC? 

When GISAC was established there was an immediate need to find office 
space for the staff. When money is not a problem usually space and many other 
things are not a problem either. Money was a problem in the early days of 
GISAC as the entity was created in the middle of the state fiscal year so paying 
rent was not an option. Luckily, GEMA was able to make available about 2500 
square feet of space adjacent to the State Operations Center. This office space 
was no stranger to some of the special agents assigned the initial GISAC duty as 
it was the same space utilized by the GBI to command the Intelligence Detail 
Teams for the Centennial Olympic Games. The space is secure, below grade, 
and has more than adequate backup power capacity; further, it is adjacent to the 
main floor of the State Operations Center and the Communications Center for 
GEMA, which also serves as the state’s 24-hour warning point. Because the GBI 
Intelligence Detail Teams use the room as a command center during every 
special event of any importance the room had been nicknamed the GBI room. It 
was only fitting then to establish those rooms as the first headquarters of GISAC, 
and the price was right too! 

After several months of operation it became apparent that more spacious 
and convenient accommodations were warranted. Although many improvements 
to the space were made including robust security measures to ensure the 
integrity of the information and files being kept, GISAC was simply outgrowing 
the makeshift offices in the underground command center of GEMA. Further, the 
FBI through the Joint Terrorism Task Force (JTTF) had emerged as a key player 
with GISAC as the state intelligence agency needed a federal partner to check 
information and run people on various federal databases. In the current office 
arrangement at GEMA the trip between the two offices took about 30 minutes, so 
the face to face interaction that needed to take place in some instances was 
thwarted by time and distance. Negotiations were initiated between the upper 
management of the FBI and State Officials concerning some available office 
space in the office building where the FBI rented their offices. A private company 
had declared bankruptcy and moved out far short of their lease period and the 
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FBI had first right of refusal on the property as it was only one floor above the 
offices of the JTTF. Through much negotiation and bureaucratic challenges on 
both the state and federal sides of the table a deal was made and the GISAC 
relocated to the same building as the Atlanta Office of the FBI and the JTTF. 
The move took about a month to complete but in September 2002 GISAC had a 
new home and at around 7,700 square feet, it was three times the size of their 
old home. The move has proven to be a wise decision as managers in both 
organizations have stated that the close proximity of the two units has fostered a 
closer and more trusted working relationship between the two. 

F. FUNDING 

Since the establishment of GISAC occurred and operations commenced 
late in the second quarter of the state’s fiscal year, funding and staffing for the 
project was a significant concern. Between Cctober 25, 2001 and April 1, 2002, 
the resources utilized for the unit were taken from the existing budgets of 
participating agencies. After April 1, 2002, a supplemental appropriation was 
made available by recommendation of the Governor and approval of the Georgia 
General Assembly. The supplemental appropriation, however, only covered the 
cost of nine budgeted positions, the standard regular operating expenses 
associated with those positions and a one-time allocation of $500,000 for office 
build out and equipment costs. Thus, the total continuing state budget for GISAC 
is the personnel services allocation for seven GBI special agent positions, two 
analyst positions, two GEMA critical infrastructure planner positions and $67, 000 
for regular operating expenses.22 Therefore, other funding and staffing 
resources had to be identified in order to operate the unit so that its mission 
could be fulfilled. In the 2002-2003 fiscal year the unit was awarded a Bryne 
grant by the Criminal Justice Coordinating Council in the amount of $400, 000. 
Had it not been for this grant the move to the FBI building would have not been 
possible as the majority of this grant is spent on real estate rental. Since that 
award there has been no additional funding for the GISAC. 


22 Office of Planning and Budget. Governor’s Amended Budget FY02. Atlanta, Georgia. 
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G. WHAT DOES THE FUTURE LOOK LIKE? 

I have examined the meetings, press releases and executive orders 
involved in the creation of GISAC. We have looked at changes in leadership 
within the state homeland security structure and the physical moves of the 
GISAC offices. A few examples of actual cases have been studied, from the 
simple to the more complex, proving that GISAC works, is needed and is a player 
in the intelligence community as it relates to the state of Georgia. Now what? 
What lies ahead for GISAC and how will it continue to transform from its roots of 
“knowing what is going on in our own backyard” and “putting our flag out” to not 
only maintaining its solid status but handling the increasing demands that are 
being placed upon it? Below I will discuss three challenges that GISAC is facing 
as it matures in being the cornerstone of Georgia’s terrorism prevention efforts. 
The first challenge is of a strategic nature, the second an operational objective 
and the third is an upcoming event that involves both strategic and operational 
concerns. 

Fundamentally, policy makers must ensure that GISAC is kept central to 
all terrorism intelligence efforts even as specialized disciplines increase their 
information sharing efforts within their own communities of practice. Secondly, 
GISAC must identify a strategy to leverage existing staff to assist in performing 
investigations when additional field expertise is needed. Situations that could 
warrant this type of staff expansion include large special security events and for 
investigating an actual occurrence of terrorism in Georgia. Finally, I will discuss 
the role of GISAC in the upcoming Group of Eight (G8) Conference that will be 
held in Georgia, June 8-10, 2004. This will be yet another seminal event for the 
young organization. 

1. Keeping GISAC Central 

One of the primary goals in establishing GISAC was to ensure that all 
terrorism intelligence information with a Georgia implication passes through the 
Center. Indeed, the GISAC has become our clearinghouse for potential terrorism 
related information and intelligence. As has been demonstrated, there are many 
organizations that have information to contribute and must be included in the 
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collection and evaluation efforts. Since 9/11 and the establishment of GISAC 
there are many disciplines both governmental and in the private sector, 
traditional and non traditional, that see the value in sharing information. This is 
especially true when the information warrants evaluation and analysis the result 
of which could confirm or dispel a suspicion that an act of terrorism is afoot. As 
various disciplines and sectors build their own sharing capability it is paramount 
that dual, or parallel systems, do not evolve. The potential for this scenario to 
develop occurred in Georgia when the agriculture sector expressed a desire to 
create an Agricultural Information Sharing and Analysis Center (AgISAC). To the 
credit of all involved in the processes, a dual system was not created. The point 
of the example is to show that as GISAC continues to be successful and the 
movement for information sharing systems/centers among sectors continues to 
grow, GISAC will have to learn how to accommodate new customers, process 
more information and demand to stay central to the overall process. Those 
objectives were accomplished by the role they have played in the development of 
the AgISAC and the role they will play in its operation. 

2. The AgISAC 

The entry point into the system is the state’s existing twenty-four hour 
communications center that is utilized as a call center to accept reports of 
suspected agroterrorism or food safety concerns. This is accomplished by 
publicizing a toll-free telephone number that is routed to the communications 
center, which is operated by GEMA. Although there is a toll-free telephone 
number the GEMA Communications Center also monitors facsimile machines 
and email emergency notification systems that could be the delivery mechanism 
for the report. The communications officer takes the report from the party 
reporting the concerned information. Based upon pre-defined protocols and 
contact information the communications officer manually notifies the appropriate 
member of the Executive/Threat Assessment Committee that a report has been 
initiated. The method of notification is determined by the committee member and 
whether the contact is made during duty or non-duty hours. Based upon the 
specificity, urgency and seriousness of the information contained in the report. 
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the committee member decides the appropriate action to take. The possibilities 
of actions by the committee member are numerous at this point but, for purposes 
of explaining the AgISAC, it is important to note two developments new to the 
system in Georgia. First, because of this initiative, now there are pre-defined 
protocols that include all of the necessary entities, both public and private, 
needed to conduct a threat assessment, and secondly, there is a secure method 
(a secure web portal) in which to discuss the information and make the 
appropriate notifications. 

When the committee member makes the decision, based upon the 
seriousness and nature of the information included in the report, to enlist the 
assistance of the other committee members is the point at which the Virtual ISAC 
technology is employed. The committee member logs into the secure portal that 
allows the member to post information to a bulletin board and select the desired 
level of notification needed to complete the threat assessment. The notification 
will be delivered via the secure portal to the other committee members, by the 
device they choose, instructing them to log on to the network to discuss the 
report and determine further appropriate actions. The members of the threat 
assessment committee represent the GISAC (this includes law enforcement and 
the FBI’s InfraGard program), the Georgia Department of Agriculture, and the 
Georgia Department of Public Health. After discussion in a secure environment, 
the appropriate disposition is determined and the various agencies conduct the 
duties required of them by regulation or law. If further notifications are 
necessary, they are accomplished by predetermined protocols through the 
secure portal to the appropriate public and/or private entity. If some type of 
public warning is required that decision is made between the lead agency, 
GISAC and the Georgia Office of Homeland Security and is performed outside of 
the secure portal through established public warning procedures and methods.23 


23 The description of the system is based upon the review of organizational meeting minutes 
and interviews with Dan Brown, Chief of Communications, GEMA. 
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The positive results of the decision to explore creating an AgISAC are 
numerous. Existing resources, like the GEMA Communications Center and the 
GISAC, are being utilized which is economically and operationally sound. 
Responsibilities and expectations between the public and private sectors, as well 
as between governmental agencies not normally accustomed to emergency 
response operations, were made clear by the development of duties and 
protocols. The high level, experienced personnel necessary to make appropriate 
determinations regarding complex issues are being allowed to participate, from 
anywhere at anytime, on the front line thanks to a technological solution. And 
ultimately the most positive result is that the public is safer because steps are 
being taken to ensure that the food supply remains as safe as possible. 

As the demand for information sharing and analysis increases to include a 
myriad of disparate sectors GISAC must remain central to the process. The role 
it plays in the coordination, awareness and potential fusing of various pieces of 
information is the fundamental principle of the Center. The evaluation of the 
information must be performed by the sector specific experts but the fusion and 
clearinghouse function must be maintained by the GISAC. In the early stages of 
GISAC this technical function of evaluating sector specific information was 
achieved solely by the “adjunct” staff members. Now as the sectors are building 
their capacity for sharing the future will see more sector specific ISACs develop 
as in evidenced by the creation of the AgISAC. The example set with this first 
“addendum ISAC” must be followed in subsequent ISACs, which will surely be 
established, in order to prevent dual efforts and creating a disjointed system. 

3. Supplemental Staff 

Notwithstanding any argument as to whether or not the current staffing 
level is adequate for their daily mission, without additional staff GISAC cannot 
adequately function in a special security event or in the event of an act of 
terrorism in Georgia. As previously mentioned the Agent in Charge of GISAC 
has the authority to task any agent of the GBI in the furtherance of an 
investigation suspected to be terrorism related. This is true regarding the 
collection of information, interviews or other investigatory techniques. The 
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problem is that this authority is primarily reserved for time sensitive matters when 
a trained GISAC agent cannot respond in a timely manner to accomplish what 
needs to be accomplished. Further, these GBI field agents have their own 
responsibilities and cannot afford to get involved in a lengthy investigation that 
would compromise the integrity of the cases for which they are responsible. 
Recognizing the need for a plan to supplement the staff of GISAC with trained 
law enforcement officers, GBI Director Vernon Keenan formulated a plan that will 
accomplish that goal. 

The Strategic Tactical Antiterrorism Response (STAR) program is the 
combination of a training program and mutual aid agreement between the GBI 
and the Multi-jurisdictional Drug Task Forces in Georgia. These task forces are a 
combination of local and state law enforcement organizations that enforce illegal 
drug laws in the state. In other words they are undercover drug agents. There 
are 31 of these task forces and they have an operational area of 92 of the 159 
counties in Georgia. There are over 300 sworn, trained officers who work in 
these units on a full time basis. These individuals are perfectly suited for fulfilling 
a supplemental staffing role for GISAC in that they are already specially trained 
for complex investigative work, can work undercover to provide human 
intelligence when needed and are geographically dispersed throughout the state. 
Many of the task forces already utilize the GBI’s case management system, have 
access to certain information systems and are familiar with many of the 
investigative and analytical functions utilized by GISAC described earlier in this 
paper like the many charting and analysis products. 

There is little that remains to be done for the STAR program concept to 
become a reality. Each officer will attend a specially developed training course 
taught by the GISAC staff that will, in effect, teach them how to convert their skills 
in criminal intelligence and investigation to that of terrorist intelligence and 
investigation. Mutual aid agreements will be signed by law enforcement 
agencies that have staff assigned to the Multi-jurisdictional Drug Task Forces. 
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These mutual aid agreements will specify the conditions under which the officers 
will become agents of GISAC, the use and access to case management systems 
and data bases, and legal issues involving liability and authority. 

4. The 2004 Group of Eight (G8) Conference 

In July 2003 President George W. Bush announced that the Group of 
Eight (G8) Economic Summit will be hosted by the United States of America and 
is to be held on Sea Island, Georgia, June 8-10, 2004. Subsequent to that 
announcement the event has been declared a National Security Special Event 
(NSSE) and the United States Secret Service has been designated lead federal 
agency status. 

It is only prudent to expect some level of protest activity near the location 
of this event given the recent history of protests at similar gatherings that 
promote free trade and the extensive media attention given to protest groups 
seeking publicity for their causes .24 Some of these protests have turned violent 
requiring the supplemental use of riot squads and other specialized units that 
mitigate other forms of civil disobedience. While the Secret Service will be the 
lead agency for securing the Summit on Sea Island, it is imperative that local and 
state agencies be prepared to respond to collateral activities associated with this 
event. State and local resources must be prepared should illegal activities occur 
outside of the declared national security event and its associated venues. While 
a coordinated effort must be maintained it is important to note there are two very 
different missions regarding the responsibilities of the Secret Service and local 
and state authorities. The primary mission of the Secret Service is to protect the 
dignitaries and ensure that the conference and associated activities are not 
disrupted. The role of the state is to support the local governments with their 
primary mission of ensuring public safety. The two missions are not mutually 
exclusive but are very distinct and are somewhat more delineated due to the 
geographical setting in which the meeting will take place. 


24 Brigitte L. Nacos, 2002. Mass-Mediated Terrorism: The Centrai Roie of the Media in 
Terrorism and Counterterrorism. Lanham, Maryland: Rowman and Littlefield Publishers, p. 72. 
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Figure 3. Sea Island, Georgia 


Sea Island, Georgia is an exclusive, privately owned resort area where 

ingress and egress can be totally controlled by human and physical security 

assets. The security concern for this event is not as much for the primary venue 
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proper as it is for the surrounding areas. The one hundred mile coastal area of 
Georgia is comprised of six counties that includes three major population 
centers; Savannah, Brunswick/Sea Island and Saint Mary’s/King’s Bay, each 
about fifty miles apart with Brunswick/Sea Island area in the center. The 
remaining area is rural. Government public safety services in this area, with the 
exception of Savannah, are modest to sparse especially considering an event of 
this magnitude. Because the federal responsibilities for this event are to secure 
the various meeting and activity venues, local and state public safety resources 
are responsible for all areas outside of the venues. Other than Sea Island itself 
venues are finite places where meetings and activities will be conducted. A 
hotel, for example, might be a venue; however the roads and public access 
leading to the venue is not part of the venue. Hence, federal resources will 
protect the venues, state and local resources must protect the surrounding areas. 
Therefore, information and intelligence concerning this event and any protest 
groups planning to attend the meeting is of paramount importance. 

Because the state of Georgia had established its information sharing link 
to the federal agencies nearly two years earlier, with the creation of GISAC, an 
integrated intelligence operation was almost instantaneously began upon the 
announcement that G8 would be held in Georgia. Information is being shared 
pre event and an integrated Intelligence Operation Center will be operated during 
the event. Below is an example of how the coordinated efforts of local, state and 
federal resources are being utilized to gather information and possibly thwart the 
planning and information gathering efforts of those who might be intent upon 
disrupting the Summit. 

“On December 23, 2003 ... GISAC received notification from the Glynn 
County Police Department... regarding a traffic stop investigation on Saint 
Simon’s Island.” (Saint Simons Island is adjacent to Sea Island, the location for 
the upcoming G8 Summit.) The individuals in the vehicle were thought, by the 
police, “to have been taking photographs of various locations around the island.” 
Subsequent to the vehicle stop officers obtained consent to search the vehicle 
and found 
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numerous electronic items, such as scanners, cameras, and video 
transmission equipment. During interviews with Glynn County 
authorities, [the suspect], a Swiss national, claimed he was the 
grandson of the owners of Reuter’s News Agency and was in the 
U.S. to cover the G8 Summit. Also, during the interviews, [the 
suspect] stated he had been on Fort Stewart in Hinesville, GA 
interviewing several soldiers. The Public Information Officer for the 
base confirmed this information. 

There was another individual in the vehicle with the suspect who had 
identification showing him to be a resident of Hinesville, GA, the location of Fort 
Stewart. “Intelligence checks on both subjects were negative and the subjects 
were released after they were questioned.” 

On January 1, 2004, the FBI Joint Terrorism Task Force and 
GISAC learned that [the suspect] had approached two Plant Hatch 
Nuclear Facility security guards on their way to work earlier that 
date and asked numerous questions about the nuclear facility. He 
requested to do a story on the security of the facility. The guards 
refused to give him any information but obtained his name from the 
identification and other paperwork he presented to them. On 
January 2, 2004, law enforcement authorities were informed by 
Reuter’s News Service [the suspect] was in no way connected to 
their company, nor was he related to the founder of Reuter’s News 
Agency. 

On January 3, 2004, FBI agents interviewed the suspect and he again 
claimed to be a reporter completing “ground work for a story on the G8 Summit.” 
He was released after the interview. The next day the suspect was confronted 
by yet another local police agency for being illegally parked at a restaurant. The 
suspect was taken into custody, fingerprinted and released. As a result of the 
fingerprints being obtained the FBI was able to complete a criminal history check 
which revealed that the suspect was using a false name and had been convicted 
of a felony in Miami, FL. Further investigation revealed that he had provided 
false information on his visa application. “On January 19, 2004, [the suspect] 
was arrested by the FBI in Newport News, VA on federal charges of visa 
fraud...and is facing possible deportation.”25 

25 The information in this case study was taken from interviews with members of GISAC and 
the quotations are directly from the Office of Homeland Security. Intelligence Bulletin, Issue 25, 
Atlanta, Georgi, January 2004, p. 1. 
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Without the integrated effort of local, state, private sector and federal 
officials this type investigation could not have occurred. Information, like this, will 
allow intelligence officials to see trends, predict future activities and determine if 
sinister plots are in the planning stages. Further, intelligence analysts can 
establish links between local individuals that may be sympathetic to groups who 
might seek to cause disruptions during the Summit. All information of this type 
contributes to the ability of public safety organizations to adequately prepare for 
and provide a safe event for the dignitaries as well as the citizens who live in the 
immediate area. Just like there are areas of responsibility for providing security, 
there are areas of responsibility for providing information and intelligence. This 
case shows that there is indeed a role for all levels of government and the private 
sector for information sharing and intelligence. 

The role of Intelligence is to provide policy makers with the information 
they need to make decisions.26 As mentioned earlier, the operation necessary to 
support this NSSE has multiple policy makers with different roles in the event. 
Each organization needs accurate, timely information analyzed with their mission 
considered so that sound policy decisions can be made regarding their mission. 
In the above case study, one only has to remove any one of the contributors to 
create a potential intelligence failure. Neither our dedicated public safety officials 
nor our country needs another Intelligence failure. In this example of harmonious 
coordination and cooperation each entity demonstrated a key role in contributing 
to the identification of this suspect resulting in his eventual capture. The 
intelligence value of this success, while significant now, will not be fully known 
until subsequent investigations are completed and until after the Summit has 
concluded. Each entity not only has a contribution to play in the intelligence 
operation of a NSSE but also has requirements they need filled by the 
intelligence community and therefore must be allowed to be a part of the 
coordinated effort. 


26 Mark Lowenthal, 2003. Intelligence: From Secrets to Policy, 2"'^ ed. CQ Press, 
Washington, D.C. p. 2. 
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Fortunately, that has been the case in Georgia concerning the intelligence 
function for G8. GISAC has been involved with the FBI and the Secret Service 
each step of the way. GISAC was included from the beginning as the Secret 
Service established the Intelligence Sub Committee and named GISAC as a co¬ 
chair of the committee. Accordingly, rather than operating independently there 
will be a fusion center or combined intelligence operations center inclusive of all 
agencies when staffs are moved forward to work the event. This integrated 
Intelligence Operations Center will be located in a secure area of the larger Multi¬ 
agency Coordination Center, a place where all parties will be commanding their 
forces. 

H. SUMMARY 

Only weeks after 9/11, in a visionary move, the state of Georgia created 
GISAC to be the central processing and collection point for all its terrorism 
related intelligence information. Public safety leaders knew that the enemy had 
infiltrated our country and “we needed to know what was going on in our own 
backyard.” In the years since being established there are now obvious reasons 
accounting for its success. 

Positive, collegial relationships were maintained and established with 
state, local and federal entities that had a stake in the mission of providing and 
sharing information. These relationships have proven to be central to the 
success of GISAC as evidenced by the various agencies that have permanently 
assigned personnel to the Center, the facilities that have been made available for 
its use and the intelligence successes demonstrated by an examination of the 
case studies. Another key to success is that the GISAC reports to the head of 
the state’s homeland security effort. The placement within the organizational 
structure of state government has survived a major transition of political power 
within the state. This stability and high position within the organizational chart of 
state government evidences the importance placed upon the GISAC and the 
state’s commitment to the unit and to the concept of information sharing. 
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The future of GISAC is filled with opportunities to grow and become more 
effective. These opportunities must be managed appropriately with the founding 
doctrines maintained. Accordingly, as new sector specific ISACs are established 
GISAC must remain central to the coordination of all activities. This coordination 
has been maintained and a template has been established with the creation of 
the Georgia AgISAC. Centrality of coordination efforts are easy to demand when 
the history of GISAC’s operational behavior and its own policies require the 
sharing of information to all pertinent entities, both traditional and nontraditional. 
This enables organizations to make determinations concerning distribution of 
intelligence to their constituencies, or in other words, they are partners in 
deciding “who needs to know”. 

The future for GISAC will also have it playing a major role in the 
preparation and planning for special events. One such event is the upcoming G8 
Summit that will be held in Georgia in June 2004. Already GISAC has been a 
key component to the intelligence efforts for this high profile event. Even though 
the event has been declared a NSSE and the Secret Service is the lead federal 
agency, GISAC has been central to the intelligence planning and operations. 
Already suspicious activities concerning the Summit has been reported through 
the GISAC system and in one particular case an individual has been arrested 
and is facing deportation for fraudulent information given on his visa. The model 
of fusing information between federal, state, local and private sector resources 
prior to an event will be field deployed and utilized during this event by 
establishing a joint intelligence operations center near the site of the Summit. 

GISAC is central to the terrorism prevention efforts of the state of Georgia. 
The success that it has enjoyed is the result of innovation, the initial political 
support given and maintained, and sound organizational doctrines. These 
principles must be maintained to ensure future successes for not only GISAC but 
for our country in its war on terrorism. Our country does not need another 
Intelligence failure and we must do everything in our power to keep that from 
occurring again. The contribution of state and local efforts to the intelligence 
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community is a huge step in preventing those potential future failures. While the 
inclusion of these efforts will not guarantee another failure from occurring their 
exclusion from the effort will most probably guarantee that it will. 
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IV. CONCLUSION 


The purpose of this thesis is to show that state and local governments 
have a key role to play in the intelligence community and that inclusion is 
mutually beneficial to all levels of government. While proving that hypothesis is 
not extremely difficult (nowadays) the proof would be useless without a solution. 
The other reasons for this thesis are to offer solutions. Those solutions include 
the requirements analysis of a successful state intelligence effort and the 
important organizational concepts for establishing a state ISAC. 

While there are both domestic and internationally based terrorist groups 
who have successfully committed acts of terrorism in the United States, the 
events of 9/11 have changed many things about life in America. One of those 
changes is the requirement that government leaders have accurate and timely 
intelligence information. Without the inclusion of state and local efforts in the 
intelligence community that requirement will not be met. For it is in the local 
communities that the terrorists are living, preparing and planning for their next 
attack. 

The terrorist attacks on September 11, 2001, seemed to initiate the 
United States into the full horrors of international terrorism. Yet the 
country is no stranger to terrorism. Since 1950 there have been 
over 3000 terrorist attacks, ranging from the Ku Klux Klan’s 
campaign of terror against the civil rights movement, through the 
waves of attacks by neo-Nazi and militia groups to the activities of 
Osama bin Laden’s al Qaeda network.27 

The supporting research and case studies throughout this thesis show the 
need to include local and state intelligence efforts is mutually beneficial to all 
levels of government. Whether the information benefits the military by exposing 
someone with dual credentials or the Bureau of Immigrations and Customs 
Enforcement by discovering illegal visitors attempting to obtain information about 
the G8 Summit, locally produced information benefits all involved. When states 

27 Christopher Hewitt. Understanding Terrorism in America. Routiedge, 2003. introductory 
Page. 
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develop single points of contact for the analysis and sharing of information, 
intelligence can be passed along to federal authorities who can “connect the 
dots” with similar efforts from other states’ to ensure that the information and 
intelligence does not stop at the state line. This is truly a federal system, 
comprised of all of the states, versus a national system. This state-included 
federal system will add hundreds of thousands of eyes and ears in the field to 
detect terrorists living in our hometowns. 

While the states contribute significantly to the established intelligence 
community by passing “up” bits and pieces of information from hundreds of 
thousands of local officials to form tactical level intelligence. States and local 
governments benefit from the intelligence community by the strategic level 
intelligence that is passed “down” regarding the capacity of especially foreign 
based organizations. Local and state governments do not have foreign spies, 
special military units, or satellites to provide them intelligence of that nature. 
They must rely on the assets of the federal government to provide that type of 
information. That information is very important, however, as state policy makers 
have significant decisions to make in committing precious prevention and 
preparedness funds. Those decisions must be made with the most robust 
information available about the enemy(s). Why prepare for a specific type of 
attack if your enemy does not possess that capability? Conversely, one had 
better prepare for the attack that your enemy is capable of initiating and one had 
better know that capability exists. Strategic intelligence is necessary for state 
and local policy makers. 

The state of Georgia quickly and aggressively embraced the challenges 

presented by the horrific attacks of 9/11 and the realization that the intelligence 

community had failed. Public safety officials understood that part of the remedy 

for that failure was to develop and add state level intelligence efforts to the 

existing intelligence community. The omission of state and local efforts occurred 

a generation earlier when the intelligence community in America was created but 

now was the time to change that omission. These attacks and the ensuing 

political reaction indicated that the strategy of using terrorism in the homeland 
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had reached a new level. The enemy seemed more organized, more capable 
and more resolute. Prior to receiving national guidance and before the publishing 
of the National Strategy for Homeland Security public safety leaders in Georgia 
established the Georgia Information Sharing and Analysis Center. Initially the 
reason was obvious; foreign terrorists had infiltrated our country, were living in 
our communities and it was the responsibility of those in local and state 
government to do their part in locating them and preventing future attacks. While 
the attacks of 9/11 and the impact of international terrorists were the impetus for 
the creation of GISAC this newly formed unit would be effective in fighting 
domestic terrorists as well. 

GISAC was formed on October 21, 2001 and was housed in the same 
building as the state’s emergency operations center. Immediately, the newly 
created unit began investigating and developing information on activities and 
individuals that may possibly be involved in terrorism. Crucial to the success of 
any effort of this type was the need to establish a relationship, or link, to the 
federal intelligence community. This was done by approaching the FBI through 
the Joint Terrorism Task Force located in Atlanta, Georgia. Investigators with the 
Georgia Bureau of Investigation led the effort to create GISAC and had a working 
relationship with the FBI through works of mutual interest in the criminal 
investigation arena. 

From the first days of its existence, GISAC began investigating leads and 
developing information on potential domestic and international terrorist activities 
in and around the state of Georgia. Those investigations have ranged from 
merely performing rumor control activities and passing “up” information that no 
one will ever know whether or not the information made a difference (like the call 
from the Georgia Department of Agriculture regarding an over anxious, over 
qualified Middle Eastern job applicant), to people who were deported due to 
fictitious travel visas. Regardless of the outcome of the investigations performed, 
GISAC has remained central to Georgia’s prevention efforts. Through those 
efforts many lessons have been learned about what is important for state 
information and sharing efforts. 
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The Alligator Alley case study revealed that almost all information 
originates locally. Further, a lesson learned is that all states need to develop a 
central point of contact to facilitate the gathering of information in a terrorism 
investigation. Events and situations develop and move quickly and states need 
to have a unit of government (preferably an ISAC) to navigate their own state’s 
bureaucracy on behalf of the state requesting investigative or antiterrorism 
information. Again, relationships are very important in this type of work and must 
be established to ensure that information flows properly. Additionally, states 
need to have a single point of contact in the federal system to navigate that 
bureaucracy and to check suspects against various databases and watch lists. 
The final point that Alligator Alley showed is that the state ISAC must be broader 
than just law enforcement. This case study was extended somewhat and 
included some “what if questions. The answers to those questions and the 
policies in place at GISAC substantiate the need for numerous subject matter 
experts and critical facility representatives included as staff members, “trusted 
partners”, or adjunct staff to the ISAC. In today’s environment law enforcement 
alone cannot possess the breadth of knowledge it takes to analyze all information 
and make accurate threat assessments on the myriad threats that exist. The list 
of expertise needed is voluminous but a few examples are biological, cyber, 
agricultural, radiological and the various critical infrastructure sectors. 

Finally, an examination of the case studies and the lessons learned during 
GISAC’s two and one half years in operation has revealed some fundamental 
principles that should be considered by other states following this model. First, 
the non-law enforcement staff members must have access to all information in 
order to render threat assessments upon that information. Only those expert in 
their field can make a credible determination relative to their discipline or their 
sector of critical infrastructure. Second, the agent in charge (or head) of the 
ISAC must have unobstructed access to the head of that jurisdictions’ Homeland 
Security top official. There are many reasons for this access but none greater 
than the potential necessity to issue an alert or warning relative to intelligence 
information. Third, as success occurs and others are want to develop their own 
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ISAC (developing sector specific ISACs is consistent with the National Strategy 
for Homeland Security) the state level ISAC must remain as the central, or main, 
hub of all intelligence information for that state regardless of the discipline or 
sector. Forth, the ISAC must generate intelligence products for customers to 
include local and state public safety policy makers so that policy makers have the 
information they need to make sound funding, operational and preparedness 
decisions. GISAC publishes weekly and monthly, classified and non classified 
reports that are distributed to various constituencies. Additionally, they have 
developed robust investigative and analysis support tools to assist customers 
with terrorism related investigations and developing intelligence. Finally, to 
ensure success in information sharing, analysis and investigations and ISAC 
must have a plan to expand its staff quickly to meet the challenges faced today. 
GISAC has two ways in which to expand its staff. First, the management of the 
unit has the authority, given by the Director of the GBI, to task any GBI agent in 
the state in the furtherance of developing intelligence information or during a 
terrorism related investigation. This authority is especially critical given the 
statewide jurisdiction of GISAC and that all employees are assigned to a central 
office. Often, quickly developing information is reported by local authorities 
located hours away from GISAC offices. In these circumstances, a locally 
assigned GBI agent is dispatched to the scene to conduct an interview or 
otherwise assist with an investigation and the information is forwarded to GISAC. 
Secondly, GISAC and the GBI are developing a program called STAR (Strategic 
Tactical Antiterrorism Response) to increase further the numbers of 
supplemental staff available for state intelligence investigations. This program 
will ensure that sufficient numbers of specifically trained investigators can be 
dispatched in a terrorism related investigation as adjuncts to the full time GISAC. 

The intelligence community was created a generation prior to 9/11 and 
was primarily designed to ensure that the United States was not the victim of a 
surprise attack or an attack with an unanticipated weapon. Sure, there were 
other capabilities and objectives of the intelligence community but that was its 
foundation. Through the years the environment has changed and as domestic 
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and foreign terrorists, who would harm America, grew in numbers and capability 
the intelligence community did not adapt. There may have been valid and 
credible reasons for not changing the system but now that must change. In order 
to increase the chances of preventing future attacks, with either domestic or 
internationally based groups, state and local law enforcement must be allowed 
ingress and egress into the intelligence community. Although many attacks have 
occurred before 9/11 the attacks on that day have been the most tragic to thus 
far. The time is right to make a major change in the system. The change that 
needs to be made is to reengineer the intelligence community to include state 
and local governments as a full partner in the fight against terrorism at home. 
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